2FAS vs Aegis Authenticator Comparison

2FAS keeps the secrets on your phone and has no copy of them. On Android the app's database is encrypted with a random key protected by the phone's keystore. On iPhone, according to the app's public source code, its own encryption of stored secrets uses a key built into the app, so the protection there comes from the phone itself and its passcode. If you turn on the Android Google Drive backup without a backup password, Google stores a readable copy. A PIN or biometric lock for the app is optional.

The secrets live in a vault file on the phone. The app has no internet permission and no account, so there is no copy with the developers. Setup offers a password by default; choosing no password leaves the vault unencrypted on the phone.

Not encrypted on Android unless you set a backup password; encrypted on iPhone. The backup is off until you turn it on; the Android app reminds you on its home screen. On Android the copy goes to a hidden folder of your Google Drive and Google can read it if you set no password. On iPhone the copy goes to iCloud, encrypted by the app with a random key kept in your iCloud Keychain, or with a key made from your own password if you set one.

Automatic backups are off until you switch them on and pick a folder, which can belong to a cloud app on the phone. Android's own cloud backup can also include the vault after you switch it on. Both work only with a password-protected vault and use your password or a separate backup password. Android's direct phone-to-phone transfer is always allowed to include the vault.

2FAS has no accounts of its own. The optional cloud backup uses your Google account on Android and your Apple account on iPhone.

There is no account and no sign-up; the app works fully offline.

The app is published by Two Factor Authentication Service, Inc., which gives an address in Henderson, Nevada. Its licence agreement for the app is governed by the laws of Delaware, with disputes going to Delaware courts or arbitration.

The Google Play listing gives Beem Development's contact address in Dordrecht, Netherlands. The app has no servers and holds no user data with the developers, so the jurisdiction matters little for the secrets themselves.

2FAS says the company was founded in 2015 and its team works fully remotely. It also makes 2FAS Pass, a password manager with a paid plan.

Beem Development is the developer name on Google Play, F-Droid and the website. Most of the code on GitHub comes from two developers, and the project is funded by donations; no company registration is named on the project's pages.

2FAS Auth is free and has no ads. The company takes donations through PayPal and says they go to app development; it also sells a yearly plan of its separate password manager.

The README and F-Droid link a donation page; there is no paid version.